contrast-agent 3.8.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.clang-format +5 -0
- data/.dockerignore +10 -0
- data/.gitignore +58 -0
- data/.gitmodules +6 -0
- data/.rspec +6 -0
- data/.simplecov +4 -0
- data/Gemfile +7 -0
- data/LICENSE.txt +12 -0
- data/Rakefile +15 -0
- data/exe/contrast_service +29 -0
- data/ext/build_funchook.rb +48 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.c +47 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.h +10 -0
- data/ext/cs__assess_active_record_named/extconf.rb +2 -0
- data/ext/cs__assess_array/cs__assess_array.c +38 -0
- data/ext/cs__assess_array/cs__assess_array.h +9 -0
- data/ext/cs__assess_array/extconf.rb +2 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +50 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.h +17 -0
- data/ext/cs__assess_basic_object/extconf.rb +2 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +86 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +34 -0
- data/ext/cs__assess_fiber_track/extconf.rb +2 -0
- data/ext/cs__assess_hash/cs__assess_hash.c +64 -0
- data/ext/cs__assess_hash/cs__assess_hash.h +24 -0
- data/ext/cs__assess_hash/extconf.rb +2 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.c +36 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.h +10 -0
- data/ext/cs__assess_kernel/extconf.rb +2 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +47 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +18 -0
- data/ext/cs__assess_marshal_module/extconf.rb +2 -0
- data/ext/cs__assess_module/cs__assess_module.c +78 -0
- data/ext/cs__assess_module/cs__assess_module.h +25 -0
- data/ext/cs__assess_module/extconf.rb +2 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.c +48 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.h +22 -0
- data/ext/cs__assess_regexp/extconf.rb +2 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c +63 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h +29 -0
- data/ext/cs__assess_regexp_track/extconf.rb +2 -0
- data/ext/cs__assess_string/cs__assess_string.c +38 -0
- data/ext/cs__assess_string/cs__assess_string.h +19 -0
- data/ext/cs__assess_string/extconf.rb +2 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +31 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h +13 -0
- data/ext/cs__assess_string_interpolation26/extconf.rb +2 -0
- data/ext/cs__common/cs__common.c +60 -0
- data/ext/cs__common/cs__common.h +28 -0
- data/ext/cs__common/extconf.rb +20 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.c +445 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.h +196 -0
- data/ext/cs__contrast_patch/extconf.rb +2 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.c +37 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.h +11 -0
- data/ext/cs__protect_kernel/extconf.rb +2 -0
- data/ext/cs__scope/cs__scope.c +96 -0
- data/ext/cs__scope/cs__scope.h +33 -0
- data/ext/cs__scope/extconf.rb +2 -0
- data/ext/extconf_common.rb +49 -0
- data/funchook/LICENSE +360 -0
- data/funchook/Makefile +29 -0
- data/funchook/Makefile.in +29 -0
- data/funchook/README.md +121 -0
- data/funchook/appveyor.yml +42 -0
- data/funchook/autogen.sh +3 -0
- data/funchook/autom4te.cache/output.0 +4976 -0
- data/funchook/autom4te.cache/requests +78 -0
- data/funchook/autom4te.cache/traces.0 +364 -0
- data/funchook/config.guess +1530 -0
- data/funchook/config.log +490 -0
- data/funchook/config.status +1016 -0
- data/funchook/config.sub +1773 -0
- data/funchook/configure +4976 -0
- data/funchook/configure.ac +59 -0
- data/funchook/distorm/COPYING +26 -0
- data/funchook/distorm/MANIFEST +25 -0
- data/funchook/distorm/MANIFEST.in +4 -0
- data/funchook/distorm/README.md +12 -0
- data/funchook/distorm/disOps/disOps.py +795 -0
- data/funchook/distorm/disOps/x86db.py +404 -0
- data/funchook/distorm/disOps/x86header.py +247 -0
- data/funchook/distorm/disOps/x86sets.py +1664 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Program.cs +79 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/TestdiStorm/TestdiStorm.csproj +69 -0
- data/funchook/distorm/examples/cs/distorm-net.sln +26 -0
- data/funchook/distorm/examples/cs/distorm-net/CodeInfo.cs +23 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedInst.cs +15 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedInst.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.cs +1268 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.tt +37 -0
- data/funchook/distorm/examples/cs/distorm-net/Operand.cs +25 -0
- data/funchook/distorm/examples/cs/distorm-net/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/diStorm3.cs +411 -0
- data/funchook/distorm/examples/cs/distorm-net/distorm-net.csproj +80 -0
- data/funchook/distorm/examples/cs/readme +3 -0
- data/funchook/distorm/examples/ddk/README +48 -0
- data/funchook/distorm/examples/ddk/distorm.ini +11 -0
- data/funchook/distorm/examples/ddk/dummy.c +15 -0
- data/funchook/distorm/examples/ddk/main.c +91 -0
- data/funchook/distorm/examples/ddk/makefile +1 -0
- data/funchook/distorm/examples/ddk/sources +10 -0
- data/funchook/distorm/examples/java/Makefile +23 -0
- data/funchook/distorm/examples/java/distorm/src/Main.java +43 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/CodeInfo.java +27 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedInst.java +32 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedInst.java +89 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/OpcodeEnum.java +131 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Opcodes.java +1123 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Operand.java +24 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/distorm3.java +41 -0
- data/funchook/distorm/examples/java/jdistorm.c +405 -0
- data/funchook/distorm/examples/java/jdistorm.h +40 -0
- data/funchook/distorm/examples/java/jdistorm.sln +20 -0
- data/funchook/distorm/examples/java/jdistorm.vcproj +208 -0
- data/funchook/distorm/examples/linux/Makefile +15 -0
- data/funchook/distorm/examples/linux/main.c +181 -0
- data/funchook/distorm/examples/tests/Makefile +15 -0
- data/funchook/distorm/examples/tests/main.cpp +42 -0
- data/funchook/distorm/examples/tests/main.py +66 -0
- data/funchook/distorm/examples/tests/test_distorm3.py +1672 -0
- data/funchook/distorm/examples/tests/tests.sln +20 -0
- data/funchook/distorm/examples/tests/tests.vcxproj +82 -0
- data/funchook/distorm/examples/tests/tests.vcxproj.filters +22 -0
- data/funchook/distorm/examples/win32/disasm.sln +25 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj +201 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj.filters +14 -0
- data/funchook/distorm/examples/win32/main.cpp +163 -0
- data/funchook/distorm/include/distorm.h +482 -0
- data/funchook/distorm/include/mnemonics.h +301 -0
- data/funchook/distorm/make/linux/Makefile +28 -0
- data/funchook/distorm/make/mac/Makefile +24 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj +239 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj.filters +80 -0
- data/funchook/distorm/make/win32/distorm.sln +25 -0
- data/funchook/distorm/make/win32/resource.h +14 -0
- data/funchook/distorm/make/win32/resource.rc +99 -0
- data/funchook/distorm/python/distorm3/__init__.py +957 -0
- data/funchook/distorm/python/distorm3/sample.py +51 -0
- data/funchook/distorm/setup.cfg +10 -0
- data/funchook/distorm/setup.py +266 -0
- data/funchook/distorm/src/config.h +169 -0
- data/funchook/distorm/src/decoder.c +641 -0
- data/funchook/distorm/src/decoder.h +33 -0
- data/funchook/distorm/src/distorm.c +413 -0
- data/funchook/distorm/src/instructions.c +597 -0
- data/funchook/distorm/src/instructions.h +463 -0
- data/funchook/distorm/src/insts.c +7939 -0
- data/funchook/distorm/src/insts.h +64 -0
- data/funchook/distorm/src/mnemonics.c +284 -0
- data/funchook/distorm/src/operands.c +1290 -0
- data/funchook/distorm/src/operands.h +28 -0
- data/funchook/distorm/src/prefix.c +368 -0
- data/funchook/distorm/src/prefix.h +64 -0
- data/funchook/distorm/src/textdefs.c +172 -0
- data/funchook/distorm/src/textdefs.h +57 -0
- data/funchook/distorm/src/wstring.c +47 -0
- data/funchook/distorm/src/wstring.h +35 -0
- data/funchook/distorm/src/x86defs.h +82 -0
- data/funchook/include/funchook.h +123 -0
- data/funchook/install-sh +527 -0
- data/funchook/src/Makefile +70 -0
- data/funchook/src/Makefile.in +70 -0
- data/funchook/src/__strerror.h +109 -0
- data/funchook/src/config.h +101 -0
- data/funchook/src/config.h.in +100 -0
- data/funchook/src/decoder.o +0 -0
- data/funchook/src/distorm.o +0 -0
- data/funchook/src/funchook.c +440 -0
- data/funchook/src/funchook.o +0 -0
- data/funchook/src/funchook_internal.h +155 -0
- data/funchook/src/funchook_io.c +182 -0
- data/funchook/src/funchook_io.h +64 -0
- data/funchook/src/funchook_io.o +0 -0
- data/funchook/src/funchook_syscall.S +134 -0
- data/funchook/src/funchook_syscall.o +0 -0
- data/funchook/src/funchook_unix.c +480 -0
- data/funchook/src/funchook_unix.o +0 -0
- data/funchook/src/funchook_windows.c +397 -0
- data/funchook/src/funchook_x86.c +622 -0
- data/funchook/src/funchook_x86.o +0 -0
- data/funchook/src/instructions.o +0 -0
- data/funchook/src/insts.o +0 -0
- data/funchook/src/libfunchook.so +0 -0
- data/funchook/src/mnemonics.o +0 -0
- data/funchook/src/operands.o +0 -0
- data/funchook/src/os_func.c +115 -0
- data/funchook/src/os_func.h +75 -0
- data/funchook/src/os_func.o +0 -0
- data/funchook/src/os_func_unix.c +94 -0
- data/funchook/src/os_func_unix.o +0 -0
- data/funchook/src/os_func_windows.c +32 -0
- data/funchook/src/prefix.o +0 -0
- data/funchook/src/printf_base.c +1688 -0
- data/funchook/src/printf_base.h +46 -0
- data/funchook/src/printf_base.o +0 -0
- data/funchook/src/textdefs.o +0 -0
- data/funchook/src/wstring.o +0 -0
- data/funchook/test/Makefile +43 -0
- data/funchook/test/Makefile.in +43 -0
- data/funchook/test/funchook_test +0 -0
- data/funchook/test/libfunchook_test.c +25 -0
- data/funchook/test/libfunchook_test.so +0 -0
- data/funchook/test/libfunchook_test2.c +18 -0
- data/funchook/test/suffix.list +600 -0
- data/funchook/test/test_main.c +430 -0
- data/funchook/test/test_main.o +0 -0
- data/funchook/test/x86_64_test.S +10 -0
- data/funchook/test/x86_64_test.o +0 -0
- data/funchook/test/x86_test.S +339 -0
- data/funchook/win32/config.h +1 -0
- data/funchook/win32/funchook.sln +52 -0
- data/funchook/win32/funchook.vcxproj +188 -0
- data/funchook/win32/funchook.vcxproj.filters +84 -0
- data/funchook/win32/funchook_test.vcxproj +170 -0
- data/funchook/win32/funchook_test.vcxproj.filters +22 -0
- data/funchook/win32/funchook_test_dll.vcxproj +184 -0
- data/funchook/win32/funchook_test_dll.vcxproj.filters +30 -0
- data/funchook/win32/funchook_test_exe.def +3 -0
- data/lib/contrast-agent.rb +8 -0
- data/lib/contrast.rb +57 -0
- data/lib/contrast/agent.rb +80 -0
- data/lib/contrast/agent/assess.rb +45 -0
- data/lib/contrast/agent/assess/adjusted_span.rb +25 -0
- data/lib/contrast/agent/assess/class_reverter.rb +82 -0
- data/lib/contrast/agent/assess/contrast_event.rb +398 -0
- data/lib/contrast/agent/assess/frozen_properties.rb +41 -0
- data/lib/contrast/agent/assess/insulator.rb +53 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +78 -0
- data/lib/contrast/agent/assess/policy/patcher.rb +85 -0
- data/lib/contrast/agent/assess/policy/policy.rb +116 -0
- data/lib/contrast/agent/assess/policy/policy_node.rb +289 -0
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +44 -0
- data/lib/contrast/agent/assess/policy/preshift.rb +94 -0
- data/lib/contrast/agent/assess/policy/propagation_method.rb +260 -0
- data/lib/contrast/agent/assess/policy/propagation_node.rb +127 -0
- data/lib/contrast/agent/assess/policy/propagator.rb +35 -0
- data/lib/contrast/agent/assess/policy/propagator/append.rb +54 -0
- data/lib/contrast/agent/assess/policy/propagator/base.rb +37 -0
- data/lib/contrast/agent/assess/policy/propagator/center.rb +73 -0
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +36 -0
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +62 -0
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +55 -0
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +26 -0
- data/lib/contrast/agent/assess/policy/propagator/next.rb +42 -0
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +50 -0
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +76 -0
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +27 -0
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +38 -0
- data/lib/contrast/agent/assess/policy/propagator/select.rb +86 -0
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +60 -0
- data/lib/contrast/agent/assess/policy/propagator/split.rb +49 -0
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +169 -0
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +81 -0
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +79 -0
- data/lib/contrast/agent/assess/policy/source_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/source_node.rb +62 -0
- data/lib/contrast/agent/assess/policy/trigger_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/trigger_node.rb +198 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +77 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +31 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +40 -0
- data/lib/contrast/agent/assess/properties.rb +392 -0
- data/lib/contrast/agent/assess/rule.rb +18 -0
- data/lib/contrast/agent/assess/rule/base.rb +72 -0
- data/lib/contrast/agent/assess/rule/csrf.rb +66 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +28 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +69 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +132 -0
- data/lib/contrast/agent/assess/rule/provider.rb +21 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +62 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +73 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +121 -0
- data/lib/contrast/agent/assess/rule/redos.rb +68 -0
- data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +47 -0
- data/lib/contrast/agent/assess/rule/response_watcher.rb +36 -0
- data/lib/contrast/agent/assess/rule/watcher.rb +36 -0
- data/lib/contrast/agent/assess/tag.rb +151 -0
- data/lib/contrast/agent/at_exit_hook.rb +33 -0
- data/lib/contrast/agent/class_reopener.rb +195 -0
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +26 -0
- data/lib/contrast/agent/deadzone/policy/policy.rb +57 -0
- data/lib/contrast/agent/disable_reaction.rb +24 -0
- data/lib/contrast/agent/exclusion_matcher.rb +190 -0
- data/lib/contrast/agent/feature_state.rb +379 -0
- data/lib/contrast/agent/inventory/policy/policy.rb +32 -0
- data/lib/contrast/agent/inventory/policy/trigger_node.rb +22 -0
- data/lib/contrast/agent/logger_manager.rb +116 -0
- data/lib/contrast/agent/middleware.rb +352 -0
- data/lib/contrast/agent/module_data.rb +16 -0
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +37 -0
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +58 -0
- data/lib/contrast/agent/patching/policy/method_policy.rb +94 -0
- data/lib/contrast/agent/patching/policy/module_policy.rb +116 -0
- data/lib/contrast/agent/patching/policy/patch.rb +312 -0
- data/lib/contrast/agent/patching/policy/patch_status.rb +192 -0
- data/lib/contrast/agent/patching/policy/patcher.rb +310 -0
- data/lib/contrast/agent/patching/policy/policy.rb +138 -0
- data/lib/contrast/agent/patching/policy/policy_node.rb +80 -0
- data/lib/contrast/agent/patching/policy/policy_unpatcher.rb +28 -0
- data/lib/contrast/agent/patching/policy/trigger_node.rb +81 -0
- data/lib/contrast/agent/protect/policy/policy.rb +37 -0
- data/lib/contrast/agent/protect/policy/trigger_node.rb +23 -0
- data/lib/contrast/agent/protect/rule.rb +58 -0
- data/lib/contrast/agent/protect/rule/base.rb +300 -0
- data/lib/contrast/agent/protect/rule/base_service.rb +88 -0
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +156 -0
- data/lib/contrast/agent/protect/rule/csrf.rb +118 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +103 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +85 -0
- data/lib/contrast/agent/protect/rule/default_scanner.rb +300 -0
- data/lib/contrast/agent/protect/rule/deserialization.rb +193 -0
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +80 -0
- data/lib/contrast/agent/protect/rule/no_sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +40 -0
- data/lib/contrast/agent/protect/rule/path_traversal.rb +143 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +16 -0
- data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +38 -0
- data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +22 -0
- data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +19 -0
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +20 -0
- data/lib/contrast/agent/protect/rule/xss.rb +24 -0
- data/lib/contrast/agent/protect/rule/xxe.rb +120 -0
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +82 -0
- data/lib/contrast/agent/railtie.rb +30 -0
- data/lib/contrast/agent/reaction_processor.rb +47 -0
- data/lib/contrast/agent/request.rb +493 -0
- data/lib/contrast/agent/request_context.rb +225 -0
- data/lib/contrast/agent/require_state.rb +61 -0
- data/lib/contrast/agent/response.rb +215 -0
- data/lib/contrast/agent/rewriter.rb +244 -0
- data/lib/contrast/agent/scope.rb +28 -0
- data/lib/contrast/agent/service_heartbeat.rb +37 -0
- data/lib/contrast/agent/settings_state.rb +148 -0
- data/lib/contrast/agent/socket_client.rb +125 -0
- data/lib/contrast/agent/thread.rb +26 -0
- data/lib/contrast/agent/tracepoint_hook.rb +51 -0
- data/lib/contrast/agent/version.rb +8 -0
- data/lib/contrast/api.rb +17 -0
- data/lib/contrast/api/.gitkeep +0 -0
- data/lib/contrast/api/connection_status.rb +49 -0
- data/lib/contrast/api/socket.rb +43 -0
- data/lib/contrast/api/speedracer.rb +206 -0
- data/lib/contrast/api/tcp_socket.rb +31 -0
- data/lib/contrast/api/unix_socket.rb +25 -0
- data/lib/contrast/common_agent_configuration.rb +86 -0
- data/lib/contrast/components/agent.rb +85 -0
- data/lib/contrast/components/app_context.rb +188 -0
- data/lib/contrast/components/assess.rb +67 -0
- data/lib/contrast/components/config.rb +135 -0
- data/lib/contrast/components/contrast_service.rb +113 -0
- data/lib/contrast/components/heap_dump.rb +34 -0
- data/lib/contrast/components/interface.rb +178 -0
- data/lib/contrast/components/inventory.rb +23 -0
- data/lib/contrast/components/logger.rb +92 -0
- data/lib/contrast/components/protect.rb +38 -0
- data/lib/contrast/components/sampling.rb +41 -0
- data/lib/contrast/components/scope.rb +106 -0
- data/lib/contrast/components/settings.rb +140 -0
- data/lib/contrast/config.rb +33 -0
- data/lib/contrast/config/agent_configuration.rb +24 -0
- data/lib/contrast/config/application_configuration.rb +27 -0
- data/lib/contrast/config/assess_configuration.rb +22 -0
- data/lib/contrast/config/assess_rules_configuration.rb +18 -0
- data/lib/contrast/config/base_configuration.rb +105 -0
- data/lib/contrast/config/default_value.rb +16 -0
- data/lib/contrast/config/exception_configuration.rb +21 -0
- data/lib/contrast/config/heap_dump_configuration.rb +23 -0
- data/lib/contrast/config/inventory_configuration.rb +20 -0
- data/lib/contrast/config/logger_configuration.rb +20 -0
- data/lib/contrast/config/protect_configuration.rb +20 -0
- data/lib/contrast/config/protect_rule_configuration.rb +37 -0
- data/lib/contrast/config/protect_rules_configuration.rb +30 -0
- data/lib/contrast/config/root_configuration.rb +26 -0
- data/lib/contrast/config/ruby_configuration.rb +39 -0
- data/lib/contrast/config/sampling_configuration.rb +22 -0
- data/lib/contrast/config/server_configuration.rb +23 -0
- data/lib/contrast/config/service_configuration.rb +22 -0
- data/lib/contrast/configuration.rb +214 -0
- data/lib/contrast/core_extensions/assess.rb +51 -0
- data/lib/contrast/core_extensions/assess/array.rb +58 -0
- data/lib/contrast/core_extensions/assess/assess_extension.rb +145 -0
- data/lib/contrast/core_extensions/assess/basic_object.rb +15 -0
- data/lib/contrast/core_extensions/assess/erb.rb +42 -0
- data/lib/contrast/core_extensions/assess/exec_trigger.rb +48 -0
- data/lib/contrast/core_extensions/assess/fiber.rb +125 -0
- data/lib/contrast/core_extensions/assess/hash.rb +22 -0
- data/lib/contrast/core_extensions/assess/kernel.rb +95 -0
- data/lib/contrast/core_extensions/assess/module.rb +14 -0
- data/lib/contrast/core_extensions/assess/regexp.rb +206 -0
- data/lib/contrast/core_extensions/assess/string.rb +75 -0
- data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb +73 -0
- data/lib/contrast/core_extensions/delegator.rb +14 -0
- data/lib/contrast/core_extensions/eval_trigger.rb +52 -0
- data/lib/contrast/core_extensions/inventory.rb +22 -0
- data/lib/contrast/core_extensions/inventory/datastores.rb +37 -0
- data/lib/contrast/core_extensions/module.rb +42 -0
- data/lib/contrast/core_extensions/object.rb +27 -0
- data/lib/contrast/core_extensions/protect.rb +20 -0
- data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb +70 -0
- data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb +58 -0
- data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb +81 -0
- data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb +119 -0
- data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb +63 -0
- data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb +141 -0
- data/lib/contrast/core_extensions/protect/kernel.rb +30 -0
- data/lib/contrast/core_extensions/protect/psych.rb +7 -0
- data/lib/contrast/core_extensions/thread.rb +31 -0
- data/lib/contrast/internal_exception.rb +8 -0
- data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb +48 -0
- data/lib/contrast/rails_extensions/assess/active_record.rb +32 -0
- data/lib/contrast/rails_extensions/assess/active_record_named.rb +61 -0
- data/lib/contrast/rails_extensions/assess/configuration.rb +26 -0
- data/lib/contrast/rails_extensions/buffer.rb +30 -0
- data/lib/contrast/rails_extensions/rack.rb +45 -0
- data/lib/contrast/security_exception.rb +14 -0
- data/lib/contrast/sinatra_extensions/assess/cookie.rb +26 -0
- data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb +59 -0
- data/lib/contrast/tasks/service.rb +95 -0
- data/lib/contrast/utils/assess/sampling_util.rb +96 -0
- data/lib/contrast/utils/assess/tracking_util.rb +39 -0
- data/lib/contrast/utils/boolean_util.rb +33 -0
- data/lib/contrast/utils/cache.rb +69 -0
- data/lib/contrast/utils/class_util.rb +58 -0
- data/lib/contrast/utils/comment_range.rb +19 -0
- data/lib/contrast/utils/data_store_util.rb +23 -0
- data/lib/contrast/utils/duck_utils.rb +58 -0
- data/lib/contrast/utils/env_configuration_item.rb +52 -0
- data/lib/contrast/utils/environment_util.rb +152 -0
- data/lib/contrast/utils/freeze_util.rb +36 -0
- data/lib/contrast/utils/gemfile_reader.rb +191 -0
- data/lib/contrast/utils/hash_digest.rb +148 -0
- data/lib/contrast/utils/heap_dump_util.rb +113 -0
- data/lib/contrast/utils/invalid_configuration_util.rb +88 -0
- data/lib/contrast/utils/inventory_util.rb +126 -0
- data/lib/contrast/utils/io_util.rb +61 -0
- data/lib/contrast/utils/object_share.rb +117 -0
- data/lib/contrast/utils/operating_environment.rb +38 -0
- data/lib/contrast/utils/os.rb +49 -0
- data/lib/contrast/utils/path_util.rb +151 -0
- data/lib/contrast/utils/performs_logging.rb +152 -0
- data/lib/contrast/utils/preflight_util.rb +13 -0
- data/lib/contrast/utils/prevent_serialization.rb +52 -0
- data/lib/contrast/utils/rack_assess_session_cookie.rb +104 -0
- data/lib/contrast/utils/rails_assess_configuration.rb +95 -0
- data/lib/contrast/utils/random_util.rb +22 -0
- data/lib/contrast/utils/resource_loader.rb +23 -0
- data/lib/contrast/utils/ruby_ast_rewriter.rb +74 -0
- data/lib/contrast/utils/scope_util.rb +99 -0
- data/lib/contrast/utils/service_response_util.rb +116 -0
- data/lib/contrast/utils/service_sender_util.rb +98 -0
- data/lib/contrast/utils/sha256_builder.rb +69 -0
- data/lib/contrast/utils/sinatra_helper.rb +49 -0
- data/lib/contrast/utils/stack_trace_utils.rb +209 -0
- data/lib/contrast/utils/string_utils.rb +72 -0
- data/lib/contrast/utils/tag_util.rb +139 -0
- data/lib/contrast/utils/thread_tracker.rb +54 -0
- data/lib/contrast/utils/timer.rb +78 -0
- data/resources/assess/policy.json +1673 -0
- data/resources/csrf/inject.js +44 -0
- data/resources/deadzone/policy.json +55 -0
- data/resources/factory-bot-spec/spec_helper.rb +30 -0
- data/resources/inventory/policy.json +110 -0
- data/resources/protect/policy.json +417 -0
- data/resources/rubocops/kernel/catch_cop.rb +37 -0
- data/resources/rubocops/kernel/require_cop.rb +37 -0
- data/resources/rubocops/kernel/require_relative_cop.rb +33 -0
- data/resources/rubocops/module/autoload_cop.rb +37 -0
- data/resources/rubocops/module/const_defined_cop.rb +37 -0
- data/resources/rubocops/module/const_get_cop.rb +37 -0
- data/resources/rubocops/module/const_set_cop.rb +37 -0
- data/resources/rubocops/module/constants_cop.rb +37 -0
- data/resources/rubocops/module/name_cop.rb +37 -0
- data/resources/rubocops/object/class_cop.rb +37 -0
- data/resources/rubocops/object/freeze_cop.rb +37 -0
- data/resources/rubocops/object/frozen_cop.rb +37 -0
- data/resources/rubocops/object/is_a_cop.rb +37 -0
- data/resources/rubocops/object/method_cop.rb +37 -0
- data/resources/rubocops/object/respond_to_cop.rb +37 -0
- data/resources/rubocops/object/singleton_class_cop.rb +37 -0
- data/resources/rubocops/regexp/spelling_cop.rb +44 -0
- data/resources/rubocops/thread/new_cop.rb +39 -0
- data/resources/ruby-spec/ancestors_spec.rb +70 -0
- data/resources/ruby-spec/modulo_spec.rb +831 -0
- data/resources/ruby-spec/parameters_spec.rb +261 -0
- data/resources/ruby-spec/ruby_spec_spec_helper.rb +35 -0
- data/resources/test_marker.txt +1 -0
- data/ruby-agent.gemspec +129 -0
- data/service_executables/.gitkeep +0 -0
- data/service_executables/VERSION +1 -0
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +945 -0
@@ -0,0 +1,33 @@
|
|
1
|
+
/*
|
2
|
+
decoder.h
|
3
|
+
|
4
|
+
diStorm3 - Powerful disassembler for X86/AMD64
|
5
|
+
http://ragestorm.net/distorm/
|
6
|
+
distorm at gmail dot com
|
7
|
+
Copyright (C) 2011 Gil Dabah
|
8
|
+
|
9
|
+
This program is free software: you can redistribute it and/or modify
|
10
|
+
it under the terms of the GNU General Public License as published by
|
11
|
+
the Free Software Foundation, either version 3 of the License, or
|
12
|
+
(at your option) any later version.
|
13
|
+
|
14
|
+
This program is distributed in the hope that it will be useful,
|
15
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
16
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
17
|
+
GNU General Public License for more details.
|
18
|
+
|
19
|
+
You should have received a copy of the GNU General Public License
|
20
|
+
along with this program. If not, see <http://www.gnu.org/licenses/>
|
21
|
+
*/
|
22
|
+
|
23
|
+
|
24
|
+
#ifndef DECODER_H
|
25
|
+
#define DECODER_H
|
26
|
+
|
27
|
+
#include "config.h"
|
28
|
+
|
29
|
+
typedef unsigned int _iflags;
|
30
|
+
|
31
|
+
_DecodeResult decode_internal(_CodeInfo* ci, int supportOldIntr, _DInst result[], unsigned int maxResultCount, unsigned int* usedInstructionsCount);
|
32
|
+
|
33
|
+
#endif /* DECODER_H */
|
@@ -0,0 +1,413 @@
|
|
1
|
+
/*
|
2
|
+
distorm.c
|
3
|
+
|
4
|
+
diStorm3 C Library Interface
|
5
|
+
diStorm3 - Powerful disassembler for X86/AMD64
|
6
|
+
http://ragestorm.net/distorm/
|
7
|
+
distorm at gmail dot com
|
8
|
+
Copyright (C) 2003-2016 Gil Dabah
|
9
|
+
This library is licensed under the BSD license. See the file COPYING.
|
10
|
+
*/
|
11
|
+
|
12
|
+
|
13
|
+
#include "../include/distorm.h"
|
14
|
+
#include "config.h"
|
15
|
+
#include "decoder.h"
|
16
|
+
#include "x86defs.h"
|
17
|
+
#include "textdefs.h"
|
18
|
+
#include "wstring.h"
|
19
|
+
#include "../include/mnemonics.h"
|
20
|
+
|
21
|
+
/* C DLL EXPORTS */
|
22
|
+
#ifdef SUPPORT_64BIT_OFFSET
|
23
|
+
_DLLEXPORT_ _DecodeResult distorm_decompose64(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount)
|
24
|
+
#else
|
25
|
+
_DLLEXPORT_ _DecodeResult distorm_decompose32(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount)
|
26
|
+
#endif
|
27
|
+
{
|
28
|
+
if (usedInstructionsCount == NULL) {
|
29
|
+
return DECRES_SUCCESS;
|
30
|
+
}
|
31
|
+
|
32
|
+
/* DECRES_SUCCESS still may indicate we may have something in the result, so zero it first thing. */
|
33
|
+
*usedInstructionsCount = 0;
|
34
|
+
|
35
|
+
if ((ci == NULL) ||
|
36
|
+
(ci->codeLen < 0) ||
|
37
|
+
((ci->dt != Decode16Bits) && (ci->dt != Decode32Bits) && (ci->dt != Decode64Bits)) ||
|
38
|
+
(ci->code == NULL) ||
|
39
|
+
(result == NULL) ||
|
40
|
+
((ci->features & (DF_MAXIMUM_ADDR16 | DF_MAXIMUM_ADDR32)) == (DF_MAXIMUM_ADDR16 | DF_MAXIMUM_ADDR32)))
|
41
|
+
{
|
42
|
+
return DECRES_INPUTERR;
|
43
|
+
}
|
44
|
+
|
45
|
+
/* Assume length=0 is success. */
|
46
|
+
if (ci->codeLen == 0) {
|
47
|
+
return DECRES_SUCCESS;
|
48
|
+
}
|
49
|
+
|
50
|
+
return decode_internal(ci, FALSE, result, maxInstructions, usedInstructionsCount);
|
51
|
+
}
|
52
|
+
|
53
|
+
#ifndef DISTORM_LIGHT
|
54
|
+
|
55
|
+
/* Helper function to concatenate an explicit size when it's unknown from the operands. */
|
56
|
+
static void distorm_format_size(_WString* str, const _DInst* di, int opNum)
|
57
|
+
{
|
58
|
+
int isSizingRequired = 0;
|
59
|
+
/*
|
60
|
+
* We only have to output the size explicitly if it's not clear from the operands.
|
61
|
+
* For example:
|
62
|
+
* mov al, [0x1234] -> The size is 8, we know it from the AL register operand.
|
63
|
+
* mov [0x1234], 0x11 -> Now we don't know the size. Pam pam pam
|
64
|
+
*
|
65
|
+
* If given operand number is higher than 2, then output the size anyways.
|
66
|
+
*/
|
67
|
+
isSizingRequired = ((opNum >= 2) || ((di->ops[0].type != O_REG) && (di->ops[1].type != O_REG)));
|
68
|
+
|
69
|
+
/* Still not sure? Try some special instructions. */
|
70
|
+
if (!isSizingRequired) {
|
71
|
+
/*
|
72
|
+
* INS/OUTS are exception, because DX is a port specifier and not a real src/dst register.
|
73
|
+
* A few exceptions that always requires sizing:
|
74
|
+
* MOVZX, MOVSX, MOVSXD.
|
75
|
+
* ROL, ROR, RCL, RCR, SHL, SHR, SAL, SAR.
|
76
|
+
* SHLD, SHRD.
|
77
|
+
*/
|
78
|
+
switch (di->opcode)
|
79
|
+
{
|
80
|
+
case I_INS:
|
81
|
+
case I_OUTS:
|
82
|
+
case I_MOVZX:
|
83
|
+
case I_MOVSX:
|
84
|
+
case I_MOVSXD:
|
85
|
+
case I_ROL:
|
86
|
+
case I_ROR:
|
87
|
+
case I_RCL:
|
88
|
+
case I_RCR:
|
89
|
+
case I_SHL:
|
90
|
+
case I_SHR:
|
91
|
+
case I_SAL:
|
92
|
+
case I_SAR:
|
93
|
+
case I_SHLD:
|
94
|
+
case I_SHRD:
|
95
|
+
isSizingRequired = 1;
|
96
|
+
break;
|
97
|
+
default: /* Instruction doesn't require sizing. */ break;
|
98
|
+
}
|
99
|
+
}
|
100
|
+
|
101
|
+
if (isSizingRequired)
|
102
|
+
{
|
103
|
+
switch (di->ops[opNum].size)
|
104
|
+
{
|
105
|
+
case 0: break; /* OT_MEM's unknown size. */
|
106
|
+
case 8: strcat_WSN(str, "BYTE "); break;
|
107
|
+
case 16: strcat_WSN(str, "WORD "); break;
|
108
|
+
case 32: strcat_WSN(str, "DWORD "); break;
|
109
|
+
case 64: strcat_WSN(str, "QWORD "); break;
|
110
|
+
case 80: strcat_WSN(str, "TBYTE "); break;
|
111
|
+
case 128: strcat_WSN(str, "DQWORD "); break;
|
112
|
+
case 256: strcat_WSN(str, "YWORD "); break;
|
113
|
+
default: /* Big oh uh if it gets here. */ break;
|
114
|
+
}
|
115
|
+
}
|
116
|
+
}
|
117
|
+
|
118
|
+
static void distorm_format_signed_disp(_WString* str, const _DInst* di, uint64_t addrMask)
|
119
|
+
{
|
120
|
+
int64_t tmpDisp64;
|
121
|
+
|
122
|
+
if (di->dispSize) {
|
123
|
+
chrcat_WS(str, ((int64_t)di->disp < 0) ? MINUS_DISP_CHR : PLUS_DISP_CHR);
|
124
|
+
if ((int64_t)di->disp < 0) tmpDisp64 = -(int64_t)di->disp;
|
125
|
+
else tmpDisp64 = di->disp;
|
126
|
+
tmpDisp64 &= addrMask;
|
127
|
+
str_code_hqw(str, (uint8_t*)&tmpDisp64);
|
128
|
+
}
|
129
|
+
}
|
130
|
+
|
131
|
+
#ifdef SUPPORT_64BIT_OFFSET
|
132
|
+
_DLLEXPORT_ void distorm_format64(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result)
|
133
|
+
#else
|
134
|
+
_DLLEXPORT_ void distorm_format32(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result)
|
135
|
+
#endif
|
136
|
+
{
|
137
|
+
_WString* str;
|
138
|
+
unsigned int i, isDefault;
|
139
|
+
int64_t tmpDisp64;
|
140
|
+
uint64_t addrMask = (uint64_t)-1;
|
141
|
+
uint8_t segment;
|
142
|
+
const _WMnemonic* mnemonic;
|
143
|
+
|
144
|
+
/* Set address mask, when default is for 64bits addresses. */
|
145
|
+
if (ci->features & DF_MAXIMUM_ADDR32) addrMask = 0xffffffff;
|
146
|
+
else if (ci->features & DF_MAXIMUM_ADDR16) addrMask = 0xffff;
|
147
|
+
|
148
|
+
/* Copy other fields. */
|
149
|
+
result->size = di->size;
|
150
|
+
result->offset = di->addr;
|
151
|
+
|
152
|
+
if (di->flags == FLAG_NOT_DECODABLE) {
|
153
|
+
str = &result->mnemonic;
|
154
|
+
result->offset &= addrMask;
|
155
|
+
strclear_WS(&result->operands);
|
156
|
+
strcpy_WSN(str, "DB ");
|
157
|
+
str_code_hb(str, di->imm.byte);
|
158
|
+
strclear_WS(&result->instructionHex);
|
159
|
+
str_hex_b(&result->instructionHex, di->imm.byte);
|
160
|
+
return; /* Skip to next instruction. */
|
161
|
+
}
|
162
|
+
|
163
|
+
str = &result->instructionHex;
|
164
|
+
strclear_WS(str);
|
165
|
+
/* Gotta have full address for (di->addr - ci->codeOffset) to work in all modes. */
|
166
|
+
for (i = 0; i < di->size; i++)
|
167
|
+
str_hex_b(str, ci->code[(unsigned int)(di->addr - ci->codeOffset + i)]);
|
168
|
+
|
169
|
+
/* Truncate address now. */
|
170
|
+
result->offset &= addrMask;
|
171
|
+
|
172
|
+
str = &result->mnemonic;
|
173
|
+
switch (FLAG_GET_PREFIX(di->flags))
|
174
|
+
{
|
175
|
+
case FLAG_LOCK:
|
176
|
+
strcpy_WSN(str, "LOCK ");
|
177
|
+
break;
|
178
|
+
case FLAG_REP:
|
179
|
+
/* REP prefix for CMPS and SCAS is really a REPZ. */
|
180
|
+
if ((di->opcode == I_CMPS) || (di->opcode == I_SCAS)) strcpy_WSN(str, "REPZ ");
|
181
|
+
else strcpy_WSN(str, "REP ");
|
182
|
+
break;
|
183
|
+
case FLAG_REPNZ:
|
184
|
+
strcpy_WSN(str, "REPNZ ");
|
185
|
+
break;
|
186
|
+
default:
|
187
|
+
/* Init mnemonic string, cause next touch is concatenation. */
|
188
|
+
strclear_WS(str);
|
189
|
+
break;
|
190
|
+
}
|
191
|
+
|
192
|
+
mnemonic = (const _WMnemonic*)&_MNEMONICS[di->opcode];
|
193
|
+
memcpy((int8_t*)&str->p[str->length], mnemonic->p, mnemonic->length + 1);
|
194
|
+
str->length += mnemonic->length;
|
195
|
+
|
196
|
+
/* Format operands: */
|
197
|
+
str = &result->operands;
|
198
|
+
strclear_WS(str);
|
199
|
+
|
200
|
+
/* Special treatment for String instructions. */
|
201
|
+
if ((META_GET_ISC(di->meta) == ISC_INTEGER) &&
|
202
|
+
((di->opcode == I_MOVS) ||
|
203
|
+
(di->opcode == I_CMPS) ||
|
204
|
+
(di->opcode == I_STOS) ||
|
205
|
+
(di->opcode == I_LODS) ||
|
206
|
+
(di->opcode == I_SCAS)))
|
207
|
+
{
|
208
|
+
/*
|
209
|
+
* No operands are needed if the address size is the default one,
|
210
|
+
* and no segment is overridden, so add the suffix letter,
|
211
|
+
* to indicate size of operation and continue to next instruction.
|
212
|
+
*/
|
213
|
+
if ((FLAG_GET_ADDRSIZE(di->flags) == ci->dt) && (SEGMENT_IS_DEFAULT(di->segment))) {
|
214
|
+
str = &result->mnemonic;
|
215
|
+
switch (di->ops[0].size)
|
216
|
+
{
|
217
|
+
case 8: chrcat_WS(str, 'B'); break;
|
218
|
+
case 16: chrcat_WS(str, 'W'); break;
|
219
|
+
case 32: chrcat_WS(str, 'D'); break;
|
220
|
+
case 64: chrcat_WS(str, 'Q'); break;
|
221
|
+
}
|
222
|
+
return;
|
223
|
+
}
|
224
|
+
}
|
225
|
+
|
226
|
+
for (i = 0; ((i < OPERANDS_NO) && (di->ops[i].type != O_NONE)); i++) {
|
227
|
+
if (i > 0) strcat_WSN(str, ", ");
|
228
|
+
switch (di->ops[i].type)
|
229
|
+
{
|
230
|
+
case O_REG:
|
231
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[di->ops[i].index]);
|
232
|
+
break;
|
233
|
+
case O_IMM:
|
234
|
+
/* If the instruction is 'push', show explicit size (except byte imm). */
|
235
|
+
if ((di->opcode == I_PUSH) && (di->ops[i].size != 8)) distorm_format_size(str, di, i);
|
236
|
+
/* Special fix for negative sign extended immediates. */
|
237
|
+
if ((di->flags & FLAG_IMM_SIGNED) && (di->ops[i].size == 8)) {
|
238
|
+
if (di->imm.sbyte < 0) {
|
239
|
+
chrcat_WS(str, MINUS_DISP_CHR);
|
240
|
+
str_code_hb(str, -di->imm.sbyte);
|
241
|
+
break;
|
242
|
+
}
|
243
|
+
}
|
244
|
+
if (di->ops[i].size == 64) str_code_hqw(str, (uint8_t*)&di->imm.qword);
|
245
|
+
else str_code_hdw(str, di->imm.dword);
|
246
|
+
break;
|
247
|
+
case O_IMM1:
|
248
|
+
str_code_hdw(str, di->imm.ex.i1);
|
249
|
+
break;
|
250
|
+
case O_IMM2:
|
251
|
+
str_code_hdw(str, di->imm.ex.i2);
|
252
|
+
break;
|
253
|
+
case O_DISP:
|
254
|
+
distorm_format_size(str, di, i);
|
255
|
+
chrcat_WS(str, OPEN_CHR);
|
256
|
+
if ((SEGMENT_GET(di->segment) != R_NONE) && !SEGMENT_IS_DEFAULT(di->segment)) {
|
257
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[SEGMENT_GET(di->segment)]);
|
258
|
+
chrcat_WS(str, SEG_OFF_CHR);
|
259
|
+
}
|
260
|
+
tmpDisp64 = di->disp & addrMask;
|
261
|
+
str_code_hqw(str, (uint8_t*)&tmpDisp64);
|
262
|
+
chrcat_WS(str, CLOSE_CHR);
|
263
|
+
break;
|
264
|
+
case O_SMEM:
|
265
|
+
distorm_format_size(str, di, i);
|
266
|
+
chrcat_WS(str, OPEN_CHR);
|
267
|
+
|
268
|
+
/*
|
269
|
+
* This is where we need to take special care for String instructions.
|
270
|
+
* If we got here, it means we need to explicitly show their operands.
|
271
|
+
* The problem with CMPS and MOVS is that they have two(!) memory operands.
|
272
|
+
* So we have to complete it ourselves, since the structure supplies only the segment that can be overridden.
|
273
|
+
* And make the rest of the String operations explicit.
|
274
|
+
*/
|
275
|
+
segment = SEGMENT_GET(di->segment);
|
276
|
+
isDefault = SEGMENT_IS_DEFAULT(di->segment);
|
277
|
+
switch (di->opcode)
|
278
|
+
{
|
279
|
+
case I_MOVS:
|
280
|
+
isDefault = FALSE;
|
281
|
+
if (i == 0) segment = R_ES;
|
282
|
+
break;
|
283
|
+
case I_CMPS:
|
284
|
+
isDefault = FALSE;
|
285
|
+
if (i == 1) segment = R_ES;
|
286
|
+
break;
|
287
|
+
case I_INS:
|
288
|
+
case I_LODS:
|
289
|
+
case I_STOS:
|
290
|
+
case I_SCAS: isDefault = FALSE; break;
|
291
|
+
}
|
292
|
+
if (!isDefault && (segment != R_NONE)) {
|
293
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[segment]);
|
294
|
+
chrcat_WS(str, SEG_OFF_CHR);
|
295
|
+
}
|
296
|
+
|
297
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[di->ops[i].index]);
|
298
|
+
|
299
|
+
distorm_format_signed_disp(str, di, addrMask);
|
300
|
+
chrcat_WS(str, CLOSE_CHR);
|
301
|
+
break;
|
302
|
+
case O_MEM:
|
303
|
+
distorm_format_size(str, di, i);
|
304
|
+
chrcat_WS(str, OPEN_CHR);
|
305
|
+
if ((SEGMENT_GET(di->segment) != R_NONE) && !SEGMENT_IS_DEFAULT(di->segment)) {
|
306
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[SEGMENT_GET(di->segment)]);
|
307
|
+
chrcat_WS(str, SEG_OFF_CHR);
|
308
|
+
}
|
309
|
+
if (di->base != R_NONE) {
|
310
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[di->base]);
|
311
|
+
chrcat_WS(str, PLUS_DISP_CHR);
|
312
|
+
}
|
313
|
+
strcat_WS(str, (const _WString*)&_REGISTERS[di->ops[i].index]);
|
314
|
+
if (di->scale != 0) {
|
315
|
+
chrcat_WS(str, '*');
|
316
|
+
if (di->scale == 2) chrcat_WS(str, '2');
|
317
|
+
else if (di->scale == 4) chrcat_WS(str, '4');
|
318
|
+
else /* if (di->scale == 8) */ chrcat_WS(str, '8');
|
319
|
+
}
|
320
|
+
|
321
|
+
distorm_format_signed_disp(str, di, addrMask);
|
322
|
+
chrcat_WS(str, CLOSE_CHR);
|
323
|
+
break;
|
324
|
+
case O_PC:
|
325
|
+
#ifdef SUPPORT_64BIT_OFFSET
|
326
|
+
str_off64(str, (di->imm.sqword + di->addr + di->size) & addrMask);
|
327
|
+
#else
|
328
|
+
str_code_hdw(str, ((_OffsetType)di->imm.sdword + di->addr + di->size) & (uint32_t)addrMask);
|
329
|
+
#endif
|
330
|
+
break;
|
331
|
+
case O_PTR:
|
332
|
+
str_code_hdw(str, di->imm.ptr.seg);
|
333
|
+
chrcat_WS(str, SEG_OFF_CHR);
|
334
|
+
str_code_hdw(str, di->imm.ptr.off);
|
335
|
+
break;
|
336
|
+
}
|
337
|
+
}
|
338
|
+
|
339
|
+
if (di->flags & FLAG_HINT_TAKEN) strcat_WSN(str, " ;TAKEN");
|
340
|
+
else if (di->flags & FLAG_HINT_NOT_TAKEN) strcat_WSN(str, " ;NOT TAKEN");
|
341
|
+
}
|
342
|
+
|
343
|
+
#ifdef SUPPORT_64BIT_OFFSET
|
344
|
+
_DLLEXPORT_ _DecodeResult distorm_decode64(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount)
|
345
|
+
#else
|
346
|
+
_DLLEXPORT_ _DecodeResult distorm_decode32(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount)
|
347
|
+
#endif
|
348
|
+
{
|
349
|
+
_DecodeResult res;
|
350
|
+
_DInst di;
|
351
|
+
_CodeInfo ci;
|
352
|
+
unsigned int instsCount = 0, i;
|
353
|
+
|
354
|
+
*usedInstructionsCount = 0;
|
355
|
+
|
356
|
+
/* I use codeLen as a signed variable in order to ease detection of underflow... and besides - */
|
357
|
+
if (codeLen < 0) {
|
358
|
+
return DECRES_INPUTERR;
|
359
|
+
}
|
360
|
+
|
361
|
+
if ((dt != Decode16Bits) && (dt != Decode32Bits) && (dt != Decode64Bits)) {
|
362
|
+
return DECRES_INPUTERR;
|
363
|
+
}
|
364
|
+
|
365
|
+
if (code == NULL || result == NULL) {
|
366
|
+
return DECRES_INPUTERR;
|
367
|
+
}
|
368
|
+
|
369
|
+
/* Assume length=0 is success. */
|
370
|
+
if (codeLen == 0) {
|
371
|
+
return DECRES_SUCCESS;
|
372
|
+
}
|
373
|
+
|
374
|
+
/*
|
375
|
+
* We have to format the result into text. But the interal decoder works with the new structure of _DInst.
|
376
|
+
* Therefore, we will pass the result array(!) from the caller and the interal decoder will fill it in with _DInst's.
|
377
|
+
* Then we will copy each result to a temporary structure, and use it to reformat that specific result.
|
378
|
+
*
|
379
|
+
* This is all done to save memory allocation and to work on the same result array in-place!!!
|
380
|
+
* It's a bit ugly, I have to admit, but worth it.
|
381
|
+
*/
|
382
|
+
|
383
|
+
ci.codeOffset = codeOffset;
|
384
|
+
ci.code = code;
|
385
|
+
ci.codeLen = codeLen;
|
386
|
+
ci.dt = dt;
|
387
|
+
ci.features = DF_NONE;
|
388
|
+
if (dt == Decode16Bits) ci.features = DF_MAXIMUM_ADDR16;
|
389
|
+
else if (dt == Decode32Bits) ci.features = DF_MAXIMUM_ADDR32;
|
390
|
+
|
391
|
+
res = decode_internal(&ci, TRUE, (_DInst*)result, maxInstructions, &instsCount);
|
392
|
+
for (i = 0; i < instsCount; i++) {
|
393
|
+
if ((*usedInstructionsCount + i) >= maxInstructions) return DECRES_MEMORYERR;
|
394
|
+
|
395
|
+
/* Copy the current decomposed result to a temp structure, so we can override the result with text. */
|
396
|
+
memcpy(&di, (char*)result + (i * sizeof(_DecodedInst)), sizeof(_DInst));
|
397
|
+
#ifdef SUPPORT_64BIT_OFFSET
|
398
|
+
distorm_format64(&ci, &di, &result[i]);
|
399
|
+
#else
|
400
|
+
distorm_format32(&ci, &di, &result[i]);
|
401
|
+
#endif
|
402
|
+
}
|
403
|
+
|
404
|
+
*usedInstructionsCount = instsCount;
|
405
|
+
return res;
|
406
|
+
}
|
407
|
+
|
408
|
+
#endif /* DISTORM_LIGHT */
|
409
|
+
|
410
|
+
_DLLEXPORT_ unsigned int distorm_version()
|
411
|
+
{
|
412
|
+
return __DISTORMV__;
|
413
|
+
}
|
@@ -0,0 +1,597 @@
|
|
1
|
+
/*
|
2
|
+
instructions.c
|
3
|
+
|
4
|
+
diStorm3 - Powerful disassembler for X86/AMD64
|
5
|
+
http://ragestorm.net/distorm/
|
6
|
+
distorm at gmail dot com
|
7
|
+
Copyright (C) 2003-2016 Gil Dabah
|
8
|
+
This library is licensed under the BSD license. See the file COPYING.
|
9
|
+
*/
|
10
|
+
|
11
|
+
|
12
|
+
#include "instructions.h"
|
13
|
+
|
14
|
+
#include "insts.h"
|
15
|
+
#include "prefix.h"
|
16
|
+
#include "x86defs.h"
|
17
|
+
#include "../include/mnemonics.h"
|
18
|
+
|
19
|
+
|
20
|
+
/* Helper macros to extract the type or index from an inst-node value. */
|
21
|
+
#define INST_NODE_INDEX(n) ((n) & 0x1fff)
|
22
|
+
#define INST_NODE_TYPE(n) ((n) >> 13)
|
23
|
+
|
24
|
+
/* Helper macro to read the actual flags that are associated with an inst-info. */
|
25
|
+
#define INST_INFO_FLAGS(ii) (FlagsTable[InstSharedInfoTable[(ii)->sharedIndex].flagsIndex])
|
26
|
+
|
27
|
+
/*
|
28
|
+
I use the trie data structure as I found it most fitting to a disassembler mechanism.
|
29
|
+
When you read a byte and have to decide if it's enough or you should read more bytes, 'till you get to the instruction information.
|
30
|
+
It's really fast because you POP the instruction info in top 3 iterates on the DB, because an instruction can be formed from two bytes + 3 bits reg from the ModR/M byte.
|
31
|
+
For a simple explanation, check this out:
|
32
|
+
http://www.csse.monash.edu.au/~lloyd/tildeAlgDS/Tree/Trie/
|
33
|
+
Further reading: http://en.wikipedia.org/wiki/Trie
|
34
|
+
|
35
|
+
The first GATE (array you read off a trie data structure), as I call them, is statically allocated by the compiler.
|
36
|
+
The second and third gates if used are being allocated dynamically by the instructions-insertion functionality.
|
37
|
+
|
38
|
+
How would such a thing look in memory, say we support 4 instructions with 3 bytes top (means 2 dynamically allocated gates).
|
39
|
+
|
40
|
+
->
|
41
|
+
|-------| 0,
|
42
|
+
|0| -------------------------------> |-------|
|
43
|
+
|1|RET | 1, |0|AND |
|
44
|
+
|2| -----> |-------| |1|XOR |
|
45
|
+
|3|INT3 | |0|PUSH | |2|OR | 0,3,
|
46
|
+
|-------| |1|POP | |3| --------->|-------|
|
47
|
+
|2|PUSHF| |-------| |0|ROR |
|
48
|
+
|3|POPF | |1|ROL |
|
49
|
+
|-------| |2|SHR |
|
50
|
+
|3|SHL |
|
51
|
+
|-------|
|
52
|
+
|
53
|
+
Of course, this is NOT how Intel instructions set looks!!!
|
54
|
+
but I just wanted to give a small demonstration.
|
55
|
+
Now the instructions you get from such a trie DB goes like this:
|
56
|
+
|
57
|
+
0, 0 - AND
|
58
|
+
0, 1 - XOR
|
59
|
+
0, 2 - OR
|
60
|
+
0, 3, 0, ROR
|
61
|
+
0, 3, 1, ROL
|
62
|
+
0, 3, 2, SHR
|
63
|
+
0, 3, 3, SHL
|
64
|
+
1 - RET
|
65
|
+
2, 0 - PUSH
|
66
|
+
2, 1 - POP
|
67
|
+
2, 2 - PUSHF
|
68
|
+
2, 3 - POPF
|
69
|
+
3 - INT3
|
70
|
+
|
71
|
+
I guess it's clear by now.
|
72
|
+
So now, if you read 0, you know that you have to enter the second gate(list) with the second byte specifying the index.
|
73
|
+
But if you read 1, you know that you go to an instruction (in this case, a RET).
|
74
|
+
That's why there's an Instruction-Node structure, it tells you whether you got to an instruction or another list
|
75
|
+
so you should keep on reading byte).
|
76
|
+
|
77
|
+
In Intel, you could go through 4 gates at top, because there are instructions which are built from 2 bytes and another smaller list
|
78
|
+
for the REG part, or newest SSE4 instructions which use 4 bytes for opcode.
|
79
|
+
Therefore, Intel's first gate is 256 long, and other gates are 256 (/72) or 8 long, yes, it costs pretty much a lot of memory
|
80
|
+
for non-used defined instructions, but I think that it still rocks.
|
81
|
+
*/
|
82
|
+
|
83
|
+
/*
|
84
|
+
* A helper function to look up the correct inst-info structure.
|
85
|
+
* It does one fetch from the index-table, and then another to get the inst-info.
|
86
|
+
* Note that it takes care about basic inst-info or inst-info-ex.
|
87
|
+
* The caller should worry about boundary checks and whether it accesses a last-level table.
|
88
|
+
*/
|
89
|
+
static _InstInfo* inst_get_info(_InstNode in, int index)
|
90
|
+
{
|
91
|
+
int instIndex = 0;
|
92
|
+
|
93
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + index];
|
94
|
+
if (in == INT_NOTEXISTS) return NULL;
|
95
|
+
|
96
|
+
instIndex = INST_NODE_INDEX(in);
|
97
|
+
return INST_NODE_TYPE(in) == INT_INFO ? &InstInfos[instIndex] : (_InstInfo*)&InstInfosEx[instIndex];
|
98
|
+
}
|
99
|
+
|
100
|
+
/*
|
101
|
+
* This function is responsible to return the instruction information of the first found in code.
|
102
|
+
* It returns the _InstInfo of the found instruction, otherwise NULL.
|
103
|
+
* code should point to the ModR/M byte upon exit (if used), or after the instruction binary code itself.
|
104
|
+
* This function is NOT decoding-type dependant, it is up to the caller to see whether the instruction is valid.
|
105
|
+
* Get the instruction info, using a Trie data structure.
|
106
|
+
*
|
107
|
+
* Sometimes normal prefixes become mandatory prefixes, which means they are now part of the instruction opcode bytes.
|
108
|
+
|
109
|
+
* This is a bit tricky now,
|
110
|
+
* if the first byte is a REP (F3) prefix, we will have to give a chance to an SSE instruction.
|
111
|
+
* If an instruction doesn't exist, we will make it as a prefix and re-locateinst.
|
112
|
+
* A case such that a REP prefix is being changed into an instruction byte and also an SSE instruction will not be found can't happen,
|
113
|
+
* simply because there are no collisions between string instruction and SSE instructions (they are escaped).
|
114
|
+
|
115
|
+
* As for S/SSE2/3, check for F2 and 66 as well.
|
116
|
+
|
117
|
+
* In 64 bits, we have to make sure that we will skip the REX prefix, if it exists.
|
118
|
+
* There's a specific case, where a 66 is mandatory but it was dropped because REG.W was used,
|
119
|
+
* but it doesn't behave as an operand size prefix but as a mandatory, so we will have to take it into account.
|
120
|
+
|
121
|
+
* For example (64 bits decoding mode):
|
122
|
+
* 66 98 CBW
|
123
|
+
* 48 98 CDQE
|
124
|
+
* 66 48 98: db 0x66; CDQE
|
125
|
+
* Shows that operand size is dropped.
|
126
|
+
|
127
|
+
* Now, it's a mandatory prefix and NOT an operand size one.
|
128
|
+
* 66480f2dc0 db 0x48; CVTPD2PI XMM0, XMM0
|
129
|
+
* Although this instruction doesn't require a REX.W, it just shows, that even if it did - it doesn't matter.
|
130
|
+
* REX.W is dropped because it's not required, but the decode function disabled the operand size even so.
|
131
|
+
*/
|
132
|
+
static _InstInfo* inst_lookup_prefixed(_InstNode in, _PrefixState* ps)
|
133
|
+
{
|
134
|
+
int checkOpSize = FALSE;
|
135
|
+
int index = 0;
|
136
|
+
_InstInfo* ii = NULL;
|
137
|
+
|
138
|
+
/* Check prefixes of current decoded instruction (None, 0x66, 0xf3, 0xf2). */
|
139
|
+
switch (ps->decodedPrefixes & (INST_PRE_OP_SIZE | INST_PRE_REPS))
|
140
|
+
{
|
141
|
+
case 0:
|
142
|
+
/* Non-prefixed, index = 0. */
|
143
|
+
index = 0;
|
144
|
+
break;
|
145
|
+
case INST_PRE_OP_SIZE:
|
146
|
+
/* 0x66, index = 1. */
|
147
|
+
index = 1;
|
148
|
+
/* Mark that we used it as a mandatory prefix. */
|
149
|
+
ps->isOpSizeMandatory = TRUE;
|
150
|
+
ps->decodedPrefixes &= ~INST_PRE_OP_SIZE;
|
151
|
+
break;
|
152
|
+
case INST_PRE_REP:
|
153
|
+
/* 0xf3, index = 2. */
|
154
|
+
index = 2;
|
155
|
+
ps->decodedPrefixes &= ~INST_PRE_REP;
|
156
|
+
break;
|
157
|
+
case INST_PRE_REPNZ:
|
158
|
+
/* 0xf2, index = 3. */
|
159
|
+
index = 3;
|
160
|
+
ps->decodedPrefixes &= ~INST_PRE_REPNZ;
|
161
|
+
break;
|
162
|
+
default:
|
163
|
+
/*
|
164
|
+
* Now we got a problem, since there are a few mandatory prefixes at once.
|
165
|
+
* There is only one case when it's ok, when the operand size prefix is for real (not mandatory).
|
166
|
+
* Otherwise we will have to return NULL, since the instruction is illegal.
|
167
|
+
* Therefore we will start with REPNZ and REP prefixes,
|
168
|
+
* try to get the instruction and only then check for the operand size prefix.
|
169
|
+
*/
|
170
|
+
|
171
|
+
/* If both REPNZ and REP are together, it's illegal for sure. */
|
172
|
+
if ((ps->decodedPrefixes & INST_PRE_REPS) == INST_PRE_REPS) return NULL;
|
173
|
+
|
174
|
+
/* Now we know it's either REPNZ+OPSIZE or REP+OPSIZE, so examine the instruction. */
|
175
|
+
if (ps->decodedPrefixes & INST_PRE_REPNZ) {
|
176
|
+
index = 3;
|
177
|
+
ps->decodedPrefixes &= ~INST_PRE_REPNZ;
|
178
|
+
} else if (ps->decodedPrefixes & INST_PRE_REP) {
|
179
|
+
index = 2;
|
180
|
+
ps->decodedPrefixes &= ~INST_PRE_REP;
|
181
|
+
}
|
182
|
+
/* Mark to verify the operand-size prefix of the fetched instruction below. */
|
183
|
+
checkOpSize = TRUE;
|
184
|
+
break;
|
185
|
+
}
|
186
|
+
|
187
|
+
/* Fetch the inst-info from the index. */
|
188
|
+
ii = inst_get_info(in, index);
|
189
|
+
|
190
|
+
if (checkOpSize) {
|
191
|
+
/* If the instruction doesn't support operand size prefix, then it's illegal. */
|
192
|
+
if ((ii == NULL) || (~INST_INFO_FLAGS(ii) & INST_PRE_OP_SIZE)) return NULL;
|
193
|
+
}
|
194
|
+
|
195
|
+
/* If there was a prefix, but the instruction wasn't found. Try to fall back to use the normal instruction. */
|
196
|
+
if (ii == NULL) ii = inst_get_info(in, 0);
|
197
|
+
return ii;
|
198
|
+
}
|
199
|
+
|
200
|
+
/* A helper function to look up special VEX instructions.
|
201
|
+
* See if it's a MOD based instruction and fix index if required.
|
202
|
+
* Only after a first lookup (that was done by caller), we can tell if we need to fix the index.
|
203
|
+
* Because these are coupled instructions
|
204
|
+
* (which means that the base instruction hints about the other instruction).
|
205
|
+
* Note that caller should check if it's a MOD dependent instruction before getting in here.
|
206
|
+
*/
|
207
|
+
static _InstInfo* inst_vex_mod_lookup(_CodeInfo* ci, _InstNode in, _InstInfo* ii, unsigned int index)
|
208
|
+
{
|
209
|
+
/* Advance to read the MOD from ModRM byte. */
|
210
|
+
ci->code += 1;
|
211
|
+
ci->codeLen -= 1;
|
212
|
+
if (ci->codeLen < 0) return NULL;
|
213
|
+
if (*ci->code < INST_DIVIDED_MODRM) {
|
214
|
+
/* MOD is not 11, therefore change the index to 8 - 12 range in the prefixed table. */
|
215
|
+
index += 4;
|
216
|
+
/* Make a second lookup for this special instruction. */
|
217
|
+
return inst_get_info(in, index);
|
218
|
+
}
|
219
|
+
/* Return the original one, in case we didn't find a suited instruction. */
|
220
|
+
return ii;
|
221
|
+
}
|
222
|
+
|
223
|
+
static _InstInfo* inst_vex_lookup(_CodeInfo* ci, _PrefixState* ps)
|
224
|
+
{
|
225
|
+
_InstNode in = 0;
|
226
|
+
unsigned int pp = 0, start = 0;
|
227
|
+
unsigned int index = 4; /* VEX instructions start at index 4 in the Prefixed table. */
|
228
|
+
uint8_t vex = *ps->vexPos, vex2 = 0, v = 0;
|
229
|
+
int instType = 0, instIndex = 0;
|
230
|
+
|
231
|
+
/* The VEX instruction will #ud if any of 66, f0, f2, f3, REX prefixes precede. */
|
232
|
+
_iflags illegal = (INST_PRE_OP_SIZE | INST_PRE_LOCK | INST_PRE_REP | INST_PRE_REPNZ | INST_PRE_REX);
|
233
|
+
if ((ps->decodedPrefixes & illegal) != 0) return NULL;
|
234
|
+
|
235
|
+
/* Read the some fields from the VEX prefix we need to extract the instruction. */
|
236
|
+
if (ps->prefixExtType == PET_VEX2BYTES) {
|
237
|
+
ps->vexV = v = (~vex >> 3) & 0xf;
|
238
|
+
pp = vex & 3;
|
239
|
+
/* Implied leading 0x0f byte by default for 2 bytes VEX prefix. */
|
240
|
+
start = 1;
|
241
|
+
} else { /* PET_VEX3BYTES */
|
242
|
+
start = vex & 0x1f;
|
243
|
+
vex2 = *(ps->vexPos + 1);
|
244
|
+
ps->vexV = v = (~vex2 >> 3) & 0xf;
|
245
|
+
pp = vex2 & 3;
|
246
|
+
}
|
247
|
+
|
248
|
+
/* start can be either 1 (0x0f), 2 (0x0f, 0x038) or 3 (0x0f, 0x3a), otherwise it's illegal. */
|
249
|
+
switch (start)
|
250
|
+
{
|
251
|
+
case 1: in = Table_0F; break;
|
252
|
+
case 2: in = Table_0F_38; break;
|
253
|
+
case 3: in = Table_0F_3A; break;
|
254
|
+
default: return NULL;
|
255
|
+
}
|
256
|
+
|
257
|
+
/* pp is actually the implied mandatory prefix, apply it to the index. */
|
258
|
+
index += pp; /* (None, 0x66, 0xf3, 0xf2) */
|
259
|
+
|
260
|
+
/* Read a byte from the stream. */
|
261
|
+
ci->codeLen -= 1;
|
262
|
+
if (ci->codeLen < 0) return NULL;
|
263
|
+
|
264
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + *ci->code];
|
265
|
+
if (in == INT_NOTEXISTS) return NULL;
|
266
|
+
|
267
|
+
instType = INST_NODE_TYPE(in);
|
268
|
+
instIndex = INST_NODE_INDEX(in);
|
269
|
+
|
270
|
+
/*
|
271
|
+
* If we started with 0f38 or 0f3a so it's a prefixed table,
|
272
|
+
* therefore it's surely a VEXed instruction (because of a high index).
|
273
|
+
* However, starting with 0f, could also lead immediately to a prefixed table for some bytes.
|
274
|
+
* it might return NULL, if the index is invalid.
|
275
|
+
*/
|
276
|
+
if (instType == INT_LIST_PREFIXED) {
|
277
|
+
_InstInfo* ii = inst_get_info(in, index);
|
278
|
+
/* See if the instruction is dependent on MOD. */
|
279
|
+
if ((ii != NULL) && (((_InstInfoEx*)ii)->flagsEx & INST_MODRR_BASED)) {
|
280
|
+
ii = inst_vex_mod_lookup(ci, in, ii, index);
|
281
|
+
}
|
282
|
+
return ii;
|
283
|
+
}
|
284
|
+
|
285
|
+
/*
|
286
|
+
* If we reached here, obviously we started with 0f. VEXed instructions must be nodes of a prefixed table.
|
287
|
+
* But since we found an instruction (or divided one), just return NULL.
|
288
|
+
* They cannot lead to a VEXed instruction.
|
289
|
+
*/
|
290
|
+
if ((instType == INT_INFO) || (instType == INT_INFOEX) || (instType == INT_LIST_DIVIDED)) return NULL;
|
291
|
+
|
292
|
+
/* Now we are left with handling either GROUP or FULL tables, therefore we will read another byte from the stream. */
|
293
|
+
ci->code += 1;
|
294
|
+
ci->codeLen -= 1;
|
295
|
+
if (ci->codeLen < 0) return NULL;
|
296
|
+
|
297
|
+
if (instType == INT_LIST_GROUP) {
|
298
|
+
in = InstructionsTree[instIndex + ((*ci->code >> 3) & 7)];
|
299
|
+
/* Continue below to check prefixed table. */
|
300
|
+
} else if (instType == INT_LIST_FULL) {
|
301
|
+
in = InstructionsTree[instIndex + *ci->code];
|
302
|
+
/* Continue below to check prefixed table. */
|
303
|
+
}
|
304
|
+
|
305
|
+
/* Now that we got to the last table in the trie, check for a prefixed table. */
|
306
|
+
if (INST_NODE_TYPE(in) == INT_LIST_PREFIXED) {
|
307
|
+
_InstInfo* ii = inst_get_info(in, index);
|
308
|
+
/* See if the instruction is dependent on MOD. */
|
309
|
+
if ((ii != NULL) && (((_InstInfoEx*)ii)->flagsEx & INST_MODRR_BASED)) {
|
310
|
+
ii = inst_vex_mod_lookup(ci, in, ii, index);
|
311
|
+
}
|
312
|
+
return ii;
|
313
|
+
}
|
314
|
+
|
315
|
+
/* No VEXed instruction was found. */
|
316
|
+
return NULL;
|
317
|
+
}
|
318
|
+
|
319
|
+
_InstInfo* inst_lookup(_CodeInfo* ci, _PrefixState* ps)
|
320
|
+
{
|
321
|
+
unsigned int tmpIndex0 = 0, tmpIndex1 = 0, tmpIndex2 = 0, rex = ps->vrex;
|
322
|
+
int instType = 0;
|
323
|
+
_InstNode in = 0;
|
324
|
+
_InstInfo* ii = NULL;
|
325
|
+
int isWaitIncluded = FALSE;
|
326
|
+
|
327
|
+
/* See whether we have to handle a VEX prefixed instruction. */
|
328
|
+
if (ps->decodedPrefixes & INST_PRE_VEX) {
|
329
|
+
ii = inst_vex_lookup(ci, ps);
|
330
|
+
if (ii != NULL) {
|
331
|
+
/* Make sure that VEX.L exists when forced. */
|
332
|
+
if ((((_InstInfoEx*)ii)->flagsEx & INST_FORCE_VEXL) && (~ps->vrex & PREFIX_EX_L)) return NULL;
|
333
|
+
/* If the instruction doesn't use VEX.vvvv it must be zero. */
|
334
|
+
if ((((_InstInfoEx*)ii)->flagsEx & INST_VEX_V_UNUSED) && ps->vexV) return NULL;
|
335
|
+
}
|
336
|
+
return ii;
|
337
|
+
}
|
338
|
+
|
339
|
+
/* Read first byte. */
|
340
|
+
ci->codeLen -= 1;
|
341
|
+
if (ci->codeLen < 0) return NULL;
|
342
|
+
tmpIndex0 = *ci->code;
|
343
|
+
|
344
|
+
/* Check for special 0x9b, WAIT instruction, which can be part of some instructions(x87). */
|
345
|
+
if (tmpIndex0 == INST_WAIT_INDEX) {
|
346
|
+
/* Only OCST_1dBYTES get a chance to include this byte as part of the opcode. */
|
347
|
+
isWaitIncluded = TRUE;
|
348
|
+
|
349
|
+
/* Ignore all prefixes, since they are useless and operate on the WAIT instruction itself. */
|
350
|
+
prefixes_ignore_all(ps);
|
351
|
+
|
352
|
+
/* Move to next code byte as a new whole instruction. */
|
353
|
+
ci->code += 1;
|
354
|
+
ci->codeLen -= 1;
|
355
|
+
if (ci->codeLen < 0) return NULL; /* Faster to return NULL, it will be detected as WAIT later anyway. */
|
356
|
+
/* Since we got a WAIT prefix, we re-read the first byte. */
|
357
|
+
tmpIndex0 = *ci->code;
|
358
|
+
}
|
359
|
+
|
360
|
+
/* Walk first byte in InstructionsTree root. */
|
361
|
+
in = InstructionsTree[tmpIndex0];
|
362
|
+
if (in == INT_NOTEXISTS) return NULL;
|
363
|
+
instType = INST_NODE_TYPE(in);
|
364
|
+
|
365
|
+
/* Single byte instruction (OCST_1BYTE). */
|
366
|
+
if ((instType < INT_INFOS) && (!isWaitIncluded)) {
|
367
|
+
/* Some single byte instructions need extra treatment. */
|
368
|
+
switch (tmpIndex0)
|
369
|
+
{
|
370
|
+
case INST_ARPL_INDEX:
|
371
|
+
/*
|
372
|
+
* ARPL/MOVSXD share the same opcode, and both have different operands and mnemonics, of course.
|
373
|
+
* Practically, I couldn't come up with a comfortable way to merge the operands' types of ARPL/MOVSXD.
|
374
|
+
* And since the DB can't be patched dynamically, because the DB has to be multi-threaded compliant,
|
375
|
+
* I have no choice but to check for ARPL/MOVSXD right here - "right about now, the funk soul brother, check it out now, the funk soul brother...", fatboy slim
|
376
|
+
*/
|
377
|
+
if (ci->dt == Decode64Bits) {
|
378
|
+
return &II_MOVSXD;
|
379
|
+
} /* else ARPL will be returned because its defined in the DB already. */
|
380
|
+
break;
|
381
|
+
|
382
|
+
case INST_NOP_INDEX: /* Nopnopnop */
|
383
|
+
/* Check for Pause, since it's prefixed with 0xf3, which is not a real mandatory prefix. */
|
384
|
+
if (ps->decodedPrefixes & INST_PRE_REP) {
|
385
|
+
/* Flag this prefix as used. */
|
386
|
+
ps->usedPrefixes |= INST_PRE_REP;
|
387
|
+
return &II_PAUSE;
|
388
|
+
}
|
389
|
+
|
390
|
+
/*
|
391
|
+
* Treat NOP/XCHG specially.
|
392
|
+
* If we're not in 64bits restore XCHG to NOP, since in the DB it's XCHG.
|
393
|
+
* Else if we're in 64bits examine REX, if exists, and decide which instruction should go to output.
|
394
|
+
* 48 90 XCHG RAX, RAX is a true NOP (eat REX in this case because it's valid).
|
395
|
+
* 90 XCHG EAX, EAX is a true NOP (and not high dword of RAX = 0 although it should be a 32 bits operation).
|
396
|
+
* Note that if the REX.B is used, then the register is not RAX anymore but R8, which means it's not a NOP.
|
397
|
+
*/
|
398
|
+
if (rex & PREFIX_EX_W) ps->usedPrefixes |= INST_PRE_REX;
|
399
|
+
if ((ci->dt != Decode64Bits) || (~rex & PREFIX_EX_B)) return &II_NOP;
|
400
|
+
break;
|
401
|
+
|
402
|
+
case INST_LEA_INDEX:
|
403
|
+
/* Ignore segment override prefixes for LEA instruction. */
|
404
|
+
ps->decodedPrefixes &= ~INST_PRE_SEGOVRD_MASK;
|
405
|
+
/* Update unused mask for ignoring segment prefix. */
|
406
|
+
prefixes_ignore(ps, PFXIDX_SEG);
|
407
|
+
break;
|
408
|
+
}
|
409
|
+
|
410
|
+
/* Return the 1 byte instruction we found. */
|
411
|
+
return instType == INT_INFO ? &InstInfos[INST_NODE_INDEX(in)] : (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in)];
|
412
|
+
}
|
413
|
+
|
414
|
+
/* Read second byte, still doesn't mean all of its bits are used (I.E: ModRM). */
|
415
|
+
ci->code += 1;
|
416
|
+
ci->codeLen -= 1;
|
417
|
+
if (ci->codeLen < 0) return NULL;
|
418
|
+
tmpIndex1 = *ci->code;
|
419
|
+
|
420
|
+
/* Try single byte instruction + reg bits (OCST_13BYTES). */
|
421
|
+
if ((instType == INT_LIST_GROUP) && (!isWaitIncluded)) return inst_get_info(in, (tmpIndex1 >> 3) & 7);
|
422
|
+
|
423
|
+
/* Try single byte instruction + reg byte OR one whole byte (OCST_1dBYTES). */
|
424
|
+
if (instType == INT_LIST_DIVIDED) {
|
425
|
+
|
426
|
+
/* Checking for inst by REG bits is higher priority if it's found not to be divided instruction. */
|
427
|
+
{
|
428
|
+
_InstNode in2 = InstructionsTree[INST_NODE_INDEX(in) + ((tmpIndex1 >> 3) & 7)];
|
429
|
+
/*
|
430
|
+
* Do NOT check for NULL here, since we do a bit of a guess work,
|
431
|
+
* hence we don't override 'in', cause we might still need it.
|
432
|
+
*/
|
433
|
+
instType = INST_NODE_TYPE(in2);
|
434
|
+
|
435
|
+
if (instType == INT_INFO) ii = &InstInfos[INST_NODE_INDEX(in2)];
|
436
|
+
else if (instType == INT_INFOEX) ii = (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in2)];
|
437
|
+
if ((ii != NULL) && (INST_INFO_FLAGS(ii) & INST_NOT_DIVIDED)) return ii;
|
438
|
+
/* ii is reset below. */
|
439
|
+
}
|
440
|
+
|
441
|
+
/* Continue normally because of wait prefix. */
|
442
|
+
if (tmpIndex1 < INST_DIVIDED_MODRM) {
|
443
|
+
/* An instruction which requires a ModR/M byte. Thus it's 1.3 bytes long instruction. */
|
444
|
+
tmpIndex1 = (tmpIndex1 >> 3) & 7; /* Isolate the 3 REG/OPCODE bits. */
|
445
|
+
} else { /* Normal 2 bytes instruction. */
|
446
|
+
/*
|
447
|
+
* Divided instructions can't be in the range of 0x8-0xc0.
|
448
|
+
* That's because 0-8 are used for 3 bits group.
|
449
|
+
* And 0xc0-0xff are used for not-divided instruction.
|
450
|
+
* So the in between range is omitted, thus saving some more place in the tables.
|
451
|
+
*/
|
452
|
+
tmpIndex1 -= INST_DIVIDED_MODRM - 8;
|
453
|
+
}
|
454
|
+
|
455
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + tmpIndex1];
|
456
|
+
if (in == INT_NOTEXISTS) return NULL;
|
457
|
+
instType = INST_NODE_TYPE(in);
|
458
|
+
|
459
|
+
if (instType < INT_INFOS) {
|
460
|
+
/* If the instruction doesn't support the wait (marked as opsize) as part of the opcode, it's illegal. */
|
461
|
+
ii = instType == INT_INFO ? &InstInfos[INST_NODE_INDEX(in)] : (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in)];
|
462
|
+
if ((~INST_INFO_FLAGS(ii) & INST_PRE_OP_SIZE) && (isWaitIncluded)) return NULL;
|
463
|
+
return ii;
|
464
|
+
}
|
465
|
+
/*
|
466
|
+
* If we got here the instruction can support the wait prefix, so see if it was part of the stream.
|
467
|
+
* Examine prefixed table, specially used for 0x9b, since it's optional.
|
468
|
+
* No Wait: index = 0.
|
469
|
+
* Wait Exists, index = 1.
|
470
|
+
*/
|
471
|
+
return inst_get_info(in, isWaitIncluded);
|
472
|
+
}
|
473
|
+
|
474
|
+
/* Don't allow to continue if WAIT is part of the opcode, because there are no instructions that include it. */
|
475
|
+
if (isWaitIncluded) return NULL;
|
476
|
+
|
477
|
+
/* Try 2 bytes long instruction (doesn't include ModRM byte). */
|
478
|
+
if (instType == INT_LIST_FULL) {
|
479
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + tmpIndex1];
|
480
|
+
if (in == INT_NOTEXISTS) return NULL;
|
481
|
+
instType = INST_NODE_TYPE(in);
|
482
|
+
|
483
|
+
/* This is where we check if we just read two escape bytes in a row, which means it is a 3DNow! instruction. */
|
484
|
+
if ((tmpIndex0 == _3DNOW_ESCAPE_BYTE) && (tmpIndex1 == _3DNOW_ESCAPE_BYTE)) return &II_3DNOW;
|
485
|
+
|
486
|
+
/* 2 bytes instruction (OCST_2BYTES). */
|
487
|
+
if (instType < INT_INFOS)
|
488
|
+
return instType == INT_INFO ? &InstInfos[INST_NODE_INDEX(in)] : (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in)];
|
489
|
+
|
490
|
+
/*
|
491
|
+
* 2 bytes + mandatory prefix.
|
492
|
+
* Mandatory prefixes can be anywhere in the prefixes.
|
493
|
+
* There cannot be more than one mandatory prefix, unless it's a normal operand size prefix.
|
494
|
+
*/
|
495
|
+
if (instType == INT_LIST_PREFIXED) return inst_lookup_prefixed(in, ps);
|
496
|
+
}
|
497
|
+
|
498
|
+
/* Read third byte, still doesn't mean all of its bits are used (I.E: ModRM). */
|
499
|
+
ci->code += 1;
|
500
|
+
ci->codeLen -= 1;
|
501
|
+
if (ci->codeLen < 0) return NULL;
|
502
|
+
tmpIndex2 = *ci->code;
|
503
|
+
|
504
|
+
/* Try 2 bytes + reg instruction (OCST_23BYTES). */
|
505
|
+
if (instType == INT_LIST_GROUP) {
|
506
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + ((tmpIndex2 >> 3) & 7)];
|
507
|
+
if (in == INT_NOTEXISTS) return NULL;
|
508
|
+
instType = INST_NODE_TYPE(in);
|
509
|
+
|
510
|
+
if (instType < INT_INFOS)
|
511
|
+
return instType == INT_INFO ? &InstInfos[INST_NODE_INDEX(in)] : (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in)];
|
512
|
+
|
513
|
+
/* It has to be a prefixed table then. */
|
514
|
+
ii = inst_lookup_prefixed(in, ps);
|
515
|
+
/* RDRAND and VMPTRLD share same 2.3 bytes opcode, and alternate on the MOD bits. See insts.h for more info. */
|
516
|
+
if ((ii != NULL) && (ii->opcodeId == I_VMPTRLD) && (tmpIndex1 >= INST_DIVIDED_MODRM)) return &II_RDRAND;
|
517
|
+
return ii;
|
518
|
+
}
|
519
|
+
|
520
|
+
/* Try 2 bytes + divided range (OCST_2dBYTES). */
|
521
|
+
if (instType == INT_LIST_DIVIDED) {
|
522
|
+
_InstNode in2 = InstructionsTree[INST_NODE_INDEX(in) + ((tmpIndex2 >> 3) & 7)];
|
523
|
+
/*
|
524
|
+
* Do NOT check for NULL here, since we do a bit of a guess work,
|
525
|
+
* hence we don't override 'in', cause we might still need it.
|
526
|
+
*/
|
527
|
+
instType = INST_NODE_TYPE(in2);
|
528
|
+
|
529
|
+
if (instType == INT_INFO) ii = &InstInfos[INST_NODE_INDEX(in2)];
|
530
|
+
else if (instType == INT_INFOEX) ii = (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in2)];
|
531
|
+
|
532
|
+
/*
|
533
|
+
* OCST_2dBYTES is complex, because there are a few instructions which are not divided in some special cases.
|
534
|
+
* If the instruction wasn't divided (but still it must be a 2.3 because we are in divided category)
|
535
|
+
* or it was an official 2.3 (because its index was less than 0xc0) -
|
536
|
+
* Then it means the instruction should be using the REG bits, otherwise give a chance to range 0xc0-0xff.
|
537
|
+
*/
|
538
|
+
/* If we found an instruction only by its REG bits, AND it is not divided, then return it. */
|
539
|
+
if ((ii != NULL) && (INST_INFO_FLAGS(ii) & INST_NOT_DIVIDED)) return ii;
|
540
|
+
/* Otherwise, if the range is above 0xc0, try the special divided range (range 0x8-0xc0 is omitted). */
|
541
|
+
if (tmpIndex2 >= INST_DIVIDED_MODRM) return inst_get_info(in, tmpIndex2 - INST_DIVIDED_MODRM + 8);
|
542
|
+
|
543
|
+
/* It might be that we got here without touching ii in the above if statements, then it becomes an invalid instruction prolly. */
|
544
|
+
return ii;
|
545
|
+
}
|
546
|
+
|
547
|
+
/* Try 3 full bytes (OCST_3BYTES - no ModRM byte). */
|
548
|
+
if (instType == INT_LIST_FULL) {
|
549
|
+
/* OCST_3BYTES. */
|
550
|
+
in = InstructionsTree[INST_NODE_INDEX(in) + tmpIndex2];
|
551
|
+
if (in == INT_NOTEXISTS) return NULL;
|
552
|
+
instType = INST_NODE_TYPE(in);
|
553
|
+
|
554
|
+
if (instType < INT_INFOS)
|
555
|
+
return instType == INT_INFO ? &InstInfos[INST_NODE_INDEX(in)] : (_InstInfo*)&InstInfosEx[INST_NODE_INDEX(in)];
|
556
|
+
|
557
|
+
if (instType == INT_LIST_PREFIXED) return inst_lookup_prefixed(in, ps);
|
558
|
+
}
|
559
|
+
|
560
|
+
/* Kahtchinggg, damn. */
|
561
|
+
return NULL;
|
562
|
+
}
|
563
|
+
|
564
|
+
/*
|
565
|
+
* 3DNow! instruction handling:
|
566
|
+
|
567
|
+
* This is used when we encounter a 3DNow! instruction.
|
568
|
+
* We can't really locate a 3DNow! instruction before we see two escaped bytes,
|
569
|
+
* 0x0f, 0x0f. Then we have to extract operands which are, dest=mmx register, src=mmx register or quadword indirection.
|
570
|
+
* When we are finished with the extraction of operands we can resume to locate the instruction by reading another byte
|
571
|
+
* which tells us which 3DNow instruction we really tracked down...
|
572
|
+
* So in order to tell the extract operands function which operands the 3DNow! instruction require, we need to set up some
|
573
|
+
* generic instruction info for 3DNow! instructions.
|
574
|
+
|
575
|
+
* In the inst_lookup itself, when we read an OCST_3BYTES which the two first bytes are 0x0f and 0x0f.
|
576
|
+
* we will return this special generic II for the specific operands we are interested in (MM, MM64).
|
577
|
+
* Then after extracting the operand, we'll call a completion routine for locating the instruction
|
578
|
+
* which will be called only for 3DNow! instructions, distinguished by a flag, and it will read the last byte of the 3 bytes.
|
579
|
+
*
|
580
|
+
* The id of this opcode should not be used, the following function should change it anyway.
|
581
|
+
*/
|
582
|
+
_InstInfo* inst_lookup_3dnow(_CodeInfo* ci)
|
583
|
+
{
|
584
|
+
/* Start off from the two escape bytes gates... which is 3DNow! table.*/
|
585
|
+
_InstNode in = Table_0F_0F;
|
586
|
+
|
587
|
+
int index;
|
588
|
+
|
589
|
+
/* Make sure we can read a byte off the stream. */
|
590
|
+
if (ci->codeLen < 1) return NULL;
|
591
|
+
|
592
|
+
index = *ci->code;
|
593
|
+
|
594
|
+
ci->codeLen -= 1;
|
595
|
+
ci->code += 1;
|
596
|
+
return inst_get_info(in, index);
|
597
|
+
}
|